Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1026412" data-attributes="member: 32260">There are several ways of blocking LOLBins. They were discussed many times on MT (including Exploit Protection tweaks):<ol>
<li data-xf-list-type="ol">SRP, AppLocker, WDAC (MDAC).</li>
<li data-xf-list-type="ol">Image File Execution Options (Debugger tweak).</li>
<li data-xf-list-type="ol">Exploit Protection (another Image File Execution Options tweak) - it can be done via Security Center. 
In some cases, additional mitigations can be needed to block the LOLBin.</li>
<li data-xf-list-type="ol">Explorer Policies (user dependent).</li>
<li data-xf-list-type="ol">Special policy for Windows Script Host.</li>
<li data-xf-list-type="ol">Special policy for CMD (user dependent).</li>
</ol>In my applications, I commonly use SRP, Exploit Protection (bitsadmin.exe in FirewallHardening), and Windows Script Host policy. The most comprehensive are methods from points 1 and 5 (especially WDAC).SRP (Applocker) is most useful, because scripting LOLBins (CMD and Windows Script Host) and MSI Installer can be selectively whitelisted for some files.Blocking LOLBins is easy, but I do not recommend this method without knowing how to find the info about blocked processes. In the case of Exploit Protection, this can be partially done via Event Id=26 (Application Popup).</blockquote>

[QUOTE="Andy Ful, post: 1026412, member: 32260"] There are several ways of blocking LOLBins. They were discussed many times on MT (including Exploit Protection tweaks): [LIST=1] [*]SRP, AppLocker, WDAC (MDAC). [*]Image File Execution Options (Debugger tweak). [*]Exploit Protection (another Image File Execution Options tweak) - it can be done via Security Center. In some cases, additional mitigations can be needed to block the LOLBin. [*]Explorer Policies (user dependent). [*]Special policy for Windows Script Host. [*]Special policy for CMD (user dependent). [/LIST] In my applications, I commonly use SRP, Exploit Protection (bitsadmin.exe in FirewallHardening), and Windows Script Host policy. The most comprehensive are methods from points 1 and 5 (especially WDAC). SRP (Applocker) is most useful, because scripting LOLBins (CMD and Windows Script Host) and MSI Installer can be selectively whitelisted for some files. Blocking LOLBins is easy, but I do not recommend this method without knowing how to find the info about blocked processes. In the case of Exploit Protection, this can be partially done via Event Id=26 (Application Popup). [/QUOTE]

Verification